New IND-CPA-D Attacks on BFV and BGV

What it is

Choe, Kang and Stehlé (ACM CCS 2026, ePrint 2026/2546, October 2026) give three attacks on BFV and BGV in the IND-CPA-D model. In this model the adversary sees the decrypted result of a computation. It matters most for FHE with threshold decryption. The attacks work when parameters are chosen using the heuristic noise assumptions that are commonly used to guarantee correct decryption.

How it works

The summary does not say which attack does what. The abstract does:

1. Bootstrapping failure attack on BGV and BFV. It extends the attacks of Cheon et al. (CCS'24) on DM/CGGI and CKKS. The BGV case is worked out for the powerful-basis representation of ring elements. It recovers the secret key.
2. Noise skewing in BFV plaintext-ciphertext multiplication. The attacker crafts plaintexts for which the heuristic noise bound does not hold, so the noise outgrows it. It recovers the secret key. This is the attack implemented in OpenFHE, with full key recovery in a few minutes to a few hours depending on parameters.
3. Mask skewing in BFV ciphertext-ciphertext multiplication. The attacker picks a random encryption of zero whose addition gives a ciphertext with a large mask norm, so noise growth exceeds the bound. It does not recover the key. It breaks the IND-CPA-D indistinguishability game.

Preconditions / Affected

• BFV and BGV deployments whose correctness relies on heuristic noise bounds rather than worst-case bounds.
• The adversary must learn computation results, as in threshold decryption or any setting that returns decrypted outputs.
• Experiments used HElib (BGV) and OpenFHE (BFV). The abstract does not name versions.

Caveats

Only the abstract is available here. It gives no parameter sets, query counts, mitigations or library patch status. Whether specific OpenFHE or HElib releases are fixed is not stated.